Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
– fairly and lawfully processed
– processed for limited purposes
– adequate, relevant and not excessive
– accurate and up to date
– not kept for longer than is necessary
– processed in line with your rights
– secure
– not transferred to other countries without adequate protection
The tool has separate checklists for Data protection assurance, Records Management, Information Security, Data sharing & subject access and Direct marketing. While you complete it, there are links to relevant guidance and further information. At the end, it generates a rating based on the responses that have been given.
https://ico.org.uk/for-organisations/improve-your-practices/data-protection-self-assessment-toolkit/
Why should SMEs use it? Information Commissioner Christopher Graham said “Good data protection practice makes business sense. It can lead to better, more efficient customer service and help to protect and enhance your reputation. It could also help you avoid a fine from the ICO.”